Totolink A3002MU CVE-2026-90607

Exploitation requires: (1) the attacker must be able to reach the boa HTTP admin interface on the A3002MU, either from the LAN or if the WAN-side admin panel is exposed; (2) the attacker must possess valid router credentials (PR:L), however default credentials (admin/admin or similar) are common on this device class and substantially lower this bar; (3) firmware version Hh-B20211125.1046 must be running, though the wildcard CPE suggests other versions may also be affected. Limits on exploitation: authentication is required (mitigated by default credentials); the attack is LAN-adjacent in typical deployments where WAN admin is disabled; the device is a consumer product with no enterprise management plane. No special protocol, kernel module, or non-default configuration setting beyond basic router operation is required.

The CVSS 4.0 score of 8.6 and the vector PR:L both indicate that authentication is required, which is the primary limiting factor relative to a raw 9.x critical. In practice, however, budget consumer routers like the A3002MU are frequently deployed with default credentials (admin/admin or similar), reducing the effective authentication barrier for an attacker with LAN access or for devices with the admin panel inadvertently exposed to the WAN. A public PoC exploit exists on GitHub, which substantially elevates real-world risk versus a theoretical finding. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, suggesting exploitation has not been broadly observed at scale. However, given the public PoC, the low-complexity attack, and the typical deployment profile of this device class (home users unlikely to patch), the risk to in-scope deployments is meaningful. The absence of a vendor patch significantly worsens the risk posture. The CVSS 4.0 subsequent-system metrics (SC:H/SI:H/SA:H) appropriately capture the downstream network impact if the router is compromised.

An attacker on the same LAN as the router (or with WAN access if the admin panel is internet-exposed) authenticates to the boa web interface using default or brute-forced credentials, then submits a crafted POST request to /boafrm/formNewSchedule with a submit-url value exceeding the target buffer size. The overflow corrupts the stack return address, redirecting execution to attacker-controlled shellcode or a ROP chain, yielding a root shell on the router. The public PoC at https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3002MU/bof-formNewSchedule.md provides working exploit primitives for this scenario.